Cloudflare's 2017 New Year's DNS outage traced to code that assumed elapsed time can never go backwards

At the leap second inserted at the end of 2016 (23:59:60 UTC on 31 December 2016), a subset of Cloudflare's DNS resolution failed. In its post-mortem, Cloudflare Engineering located the fault not in the clock but in an assumption baked into its own software: "the root cause of the bug that affected our DNS service was the belief that time cannot go backwards... some code assumed that the difference between two times would always be, at worst, zero." When the leap second briefly made a computed time-delta negative, that negative value was fed into a weighted random-selection routine that had never been designed to receive one, and the routine failed.

The episode is a concrete instance of a recurring class of failure: production infrastructure breaking not because atomic timekeeping is wrong but because engineers encode folk assumptions about time — that a minute always has 60 seconds, that elapsed time is monotonic, that a duration cannot be negative — which the leap second periodically violates. Reddit's 2012 outage during an earlier leap second is a sibling case. The pattern is what makes the +1-second reconciliation between atomic time (TAI) and the Earth's irregular rotation (UT1) a standing operational liability rather than a one-off curiosity.

That operational liability is precisely the rationale the world's metrology body later cited when it moved to retire the leap second — see claim-2022-cgpm-voted-to-end-leap-seconds-by-2035, whose resolution names uncoordinated leap-second handling as a threat to critical-infrastructure resilience. Private-sector engineering had already reached for its own workaround, "leap smearing" (spreading the extra second across a day so no clock ever reads :60), which predates and parallels the political fix; that thread is noted but unpulled in the source capture.